This invention relates to the use of intelligent cards to effect terminal transactions, and more particularly to the prevention of the fraudulent use of such cards.
Much work has been done in recent years on the furnishing of intelligent cards, of the "credit card" type, to consumers; such intelligent cards include a memory and have a data processing capability, the latter being in hard-wired form or more preferably in the form of a microprocessor with a stored program. (Although developments thus far are in the form of cards, it is to be understood that a small memory and microprocessor can be incorporated in other portable media, such as pens, keys, etc.; as used herein, the term "intelligent card" refers to any medium which can be conveniently carried by a user and which performs the functions to be described below.) Much of the work on intelligent cards has been performed abroad, particularly in France, and a prior art patent illustrating the general concept is that of Michel Ugon, U.S. Pat. No. 4,211,919, issued on July 8, 1980 and entitled "Portable Data Carrier Including A Microprocessor".
A typical intelligent card might contain a personal identification number, i.e., a secret password, as well as a dollar value. (The term "password", as used herein, refers to either a memorized sequence of symbols or a set of numerical data derived from physiological attributes, such as a signature, voice sample or fingerprint, of the legitimate card user.) The card issuer might initially store a value in the card representing $500, upon payment of this amount by the user. Whenever the card is used in a purchase transaction, the value of the transaction is subtracted from the value remaining on the card, the new value representing the available user credit. Before any transaction takes place, the card is placed in a terminal and the user is required to input his password. (If the password is a derivate of physiological attributes, "input his password" should be understood to mean supply a signature, voice sample, fingerprint or other physiological sample to an analytical device in the terminal which produces the derivate defined as the password.) If the terminal verifies a match between the user-inputted password and the password stored on the card, the transaction is allowed to proceed. (For a physiologically derived password, the term "match" should be understood to mean an acceptable resemblance rather than an exact coincidence.) For maximum security, the password comparison should take place in the card itself; the terminal transmits the inputted password to the card and the logic on the card compares the inputted password with the stored password, and informs the terminal whether the correct password has been entered. The advantage of not allowing the password to "leave the card" for comparison in the terminal is that a thief cannot determine the stored password and therefore cannot use the card. Were the comparison to take place in the terminal, someone with a background in electronics could access the card password once it is stored in the terminal, and thus learn the correct password to be used with the card.
It is to be understood, of course, that purchase transactions are only one example of the use of intelligent cards. As is known in the art, intelligent cards can also be used to access data banks, make airlines reservations, decrypt at a terminal incoming messages which are transmitted in encrypted form, as well as for numerous other purposes. A novel use of an intelligent card is disclosed in my copending application Ser. No. 312,706, entitled "Electronic Document Authentication System" and filed on even date herewith, which application is hereby incorporated by reference. In general, the term "transaction" as used herein refers to any transaction effected by a terminal when a user intelligent card is inserted in it.
A major concern in the use of intelligent cards in this manner on a widespread scale is their possible susceptibility to fraud. When it is recognized that an intelligent card may allow its user to obtain hundreds and even thousands of dollars of credit, and in an extreme case even to obtain large amounts of cash or negotiable traveler's checks if a transaction terminal is provided for issuing cash or traveler's checks, it becomes apparent that card-controlled transaction terminals will not be commonplace until there is some way to protect against the fraudulent use of cards. It is a general object of my invention to provide such a protection system.
There are several different kinds of intelligent-card security which must be distinguished from each other. The first relates to the fraudulent issuance of genuine cards. A genuine card is one produced by an authorized manufacturer for delivery to a card issuer, the card issuer then initializing the cards, e.g., with a dollar value, and furnishing them to card users. The problem here is that genuine cards may be intercepted during shipment from the card manufacturer to the card issuer, or even stolen by dishonest employees of the card issuer. Techniques have already been developed for protecting against illegitimate issuance of genuine cards, and such a scheme is incorporated in the illustrative embodiment of the invention to be described in detail below.
The second aspect of card security relates to the use of a stolen card by a thief, a situation which will probably be commonplace. Secret password schemes have been devised in the prior art, as described above, to protect against the fraudulent use of a card in such a case. (Unfortunately, no way has yet been found to overcome a criminal forcing a card owner to tell him the password. Violent crimes of this type, however, occur much less frequently than attempted use of a stolen card. Moreover, there is just as great a risk in carrying cash as there is in carrying an intelligent card when it comes to violent crimes of this nature).
The problem which has thus far resisted solution concerns the criminal with a sophisticated electronics background. Such a criminal could actually manufacture intelligent cards and construct an issuer initialization terminal of his own. He could then actually initialize cards which could be used in transaction terminals of a legitimate card issuer. The problem is aggravated because a criminal with an electronics background need not even go to so much trouble.
It is expected that many transaction terminals will be unattended, that is, a card user will be able to effect a transaction in such a terminal without the terminal being attended by any personnel employed by the card issuer. There are already many such unattended terminals in place today, for example, those which allow the owner of a bank card to receive a packet of cash during nonbanking hours. It must be recalled that the basic protection scheme proposed in the prior art is the inputting of a password into the terminal by a card user, and the comparison of the inputted password in the card itself, with the card then informing the terminal whether the passwords match. Security can be completely broken by the simple expedient of inserting a specially-constructed card into the terminal. If the terminal is such that user cards are not completely absorbed and the ingress passage is not cut off, the card can be nothing more than a contact board (of card dimensions) being connected by a set of wires to an electronic "black box" carried on the person of the criminal. It is not necessary to even be concerned with the storage of a password in the "black box" which the criminal would, of course, know and input on the terminal keyboard. All the criminal has to do is to provide a signal to the terminal at the appropriate time which informs the terminal that the inputted password matches the password stored on the card. The terminal expects to receive a "yes" or a "no" answer and the electronic forger simply has to know how to furnish a "yes" answer when the terminal expects the result of the password comparison. The problem is obviously most severe in the case of unattended terminals where there is no one present to even check that what "looks" like a legitimate card is being placed in the terminal. In the case of a value card, for example, it would be a trivial matter for the forger's "black box" to inform the terminal that the card user has a considerable credit available to him.
One scheme has been proposed in the prior art for guarding against identification fraud. This scheme, which is marketed under the mark "Identikey", will be described in detail below. Its basic weakness is that it relies on a secret code transformation which is stored in each transaction terminal. With the proliferation of terminals, it will not be difficult for a forger to gain access to a terminal and to discover the secret transformation algorithm. As will become apparent below, once the transformation is determined a forger can varify his identity to the satisfaction of the terminal and possibly thereby gain access to privileges and services, although it is much more difficult for him to represent himself as a particular legitimate user.
In accordance with the principles of my invention, I provide a protection system for intelligent cards which is based in part on the principles of a new branch of cryptography known as "public-key cryptography". One of the earliest works on the subject is that of Diffie and Hellman, "New Directions In Cryptography", IEEE Transactions On Information Theory, November, 1976. Another significant advance in the field was described in the 1977 paper by Rivest, Shamir and Adleman, entitled "On Digital Signatures And Public-Key Cryptosystems", MIT/LCS/TM-82, of the Massachusetts Institute of Technology. Perhaps the clearest exposition of the subject is to be found in the August, 1979 issue of Scientific American, in an article by Hellman entitled "The Mathematics of Public-Key Cryptography".